PT-2024-30696 · Linux+7 · Linux Kernel+7

Published

2024-07-14

·

Updated

2025-09-29

·

CVE-2024-43834

CVSS v3.1

5.5

Medium

VectorAV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.50
Description The issue arises from the invalid wait context of page pool destroy() when a driver uses a page pool and XDP (eXpress Data Path). The page pool create() function creates a page pool with a default reference count of 1. When the driver uses XDP, it registers a memory model with xdp rxq info reg mem model(), which increases the page pool reference count to 2 if the memory model is a page pool. To destroy the page pool, the driver must call both page pool destroy() and xdp unreg mem model(). However, if page pool destroy() is called before xdp unreg mem model(), it results in an invalid wait context warning because xdp unreg mem model() calls page pool destroy() with rcu read lock(), while page pool destroy() internally acquires mutex lock().
The problem is fixed by using rhashtable lookup fast() instead of rhashtable lookup() with rcu read lock(). The xa is freed by xdp mem allocator rcu free(), which is called by call rcu() of mem xa remove(). The mem xa remove() is called by page pool destroy() when the reference count reaches 0. Since xa is already protected by the reference count mechanism in the control plane, removing rcu read lock() for page pool destroy() is safe.
Recommendations To resolve the issue, update the Linux kernel to version 6.6.50 or later. For versions prior to 6.6.50, ensure that page pool destroy() and xdp unreg mem model() are called in the correct order to avoid the invalid wait context warning. If possible, consider disabling the use of XDP or the page pool destroy() function until the update can be applied.

Exploit

Fix

Use After Free

Found an issue in the description? Have something to add? Feel free to write us 👾

Weakness Enumeration

Related Identifiers

ALSA-2025_12746
ALSA-2025_12752
ALSA-2025_12753
ALSA-2025_16880
ALT-PU-2024-14046
AZL-51980
BDU:2025-01723
CVE-2024-43834
DLA-3912-1
DLA-4008-1
INFSA-2025_6966
MGASA-2024-0309
MGASA-2024-0310
OESA-2024-2106
OESA-2024-2107
OESA-2024-2108
OESA-2024-2296
OPENSUSE-SU-2024_3190-1
OPENSUSE-SU-2024_3209-1
OPENSUSE-SU-2024_3483-1
RHSA-2025:6966
RHSA-2025_6966
SUSE-SU-2024:3190-1
SUSE-SU-2024:3194-1
SUSE-SU-2024:3195-1
SUSE-SU-2024:3209-1
SUSE-SU-2024:3383-1
SUSE-SU-2024:3483-1
SUSE-SU-2025:20044-1
SUSE-SU-2025:20047-1
USN-7100-1
USN-7100-2
USN-7123-1
USN-7144-1
USN-7154-1
USN-7154-2
USN-7155-1
USN-7156-1
USN-7194-1
USN-7196-1

Affected Products

Alt Linux
Astra Linux
Linuxmint
Linux Kernel
Red Hat
Red Os
Suse
Ubuntu